Permanent TSB mail phishing attack

biko

Got mail yesterday from Permanent TSB. Looked real enough and unfortunately some people will fall for these scams.
This post is to warn anyone who may have fallen for it or gets one of these mails in the future.

I immediately reported it to abuse@permanenttsb.ie and info@permanenttsb.ie and today the links are not working so PTSB may have acted on it.

Could have fallen for it unless I remembered the message on the PTSB website

permanent tsb will NEVER ask you to confirm your secure log on details or any personal details by email and will NEVER ask you for personal details online.

and also by hovering the link I noticed it doesn't lead to PSTB but to a site hacked by Chinese scammers.

As I have browser protection I checked where the link took me and the site I came to looked exactly like https://www.open24.ie/online/login.aspx (minus the security notice of course).
It didn't try to install any trojans or other crap.

Note, mail below has the real link but it doesn't work any more


Dear Customer,
It has come to our attention that your Open24 contact information records are out of date.
Please Log in to Open24 and update your account.

permanent tsb 56/59 St. Stephens Green, Dublin 2. Irish Life & Permanent plc (trading as permanent tsb) is regulated by the Financial Regulator. Irish Life & Permanent plc. is a tied insurance agent for Irish Life Assurance plc. Irish Life & Permanent plc is a limited liability company registered in Dublin under No. 222332. The company's registered office is: Irish Life Centre, Lower Abbey Street, Dublin 1.

BuffyBot

I've removed the link to the scam site from your post.. just in case.